ISO/IEC 17025:2017

a tutorial for

UKAS Assessment StaffTrevor Thompson

January 2018

Reminder of the principles

ISO/IEC 17025 is the international standard used to accredit the

competence of testing and calibration laboratories worldwide

Such competence is taken to be assured by the presence of certain

features in the laboratory and its organisation:

1. Ability technically to get a valid result. This involves people,

knowledge, equipment, supplies and process.

“getting it right”

2. A system to ensure impartiality, consistency, reliability

“once right……always right”

Applying the principles

These principles have applied to the various earlier versions of the

Standard but were described in a more prescriptive way.

Now in the 2017 version the laboratory is left to decide how to achieve

any requirement, expressed more in the form of an required outcome.

All based on anticipated/perceived risk and opportunity.

Examples:

“job descriptions” is now “staff shall be aware of their responsibilities”

“quality manual” “procedures” are now “necessary documented

information”

Other Changes

In rewriting the Standard we tried also to modernise it to remove

references to paper and to ensure it catered for electronic data

presentation, transmission, storage etc and to be relatively future-

proof.

There are very few technical changes to the requirements to be met by

the laboratories. Where changes have been made we have included

elements from documents previously written to offer interpretation.

For example, in traceability and in decision rules

In appearance, the biggest change is that of the structure of the

document. Completely different!

Why Restructure 17025?

Experience with industry has shown a need for compatibility with ISO

9001 and related Standards.

This needs to apply both ways round…i.e.

A lab using 17025 needs to be considered as suitable as a 9001

contractor and should not need both.

An organisation with 9001 should be able to add the technical

requirements of 17025 to his existing system and be considered a

17025 lab.

Management System Options

Option A – Using ISO 17025 directly, as before

Option B – Using ISO 9001 but ensuring that the MS meets

the technical needs of 17025

The difference? Not a lot, as the new 17025 has largely

been aligned with 9001 for requirements and terms

We assess that the system covers the 17025 requirements

The new structure

For a laboratory, in line with the other 17000 series

standards:

Structure: “What it looks like”

Resource: “What it needs to have”

Process: “What it needs to do”

Some mandatory text (esp Options A and B)

Headlines of Changes

Option to allow ISO 9001 MS

needs to cover 17025 technical clauses

Risks and Opportunities to be considered

measures necessary in a given lab therefore vary

Decision Rules; any sensible ones to be agreed

risks of false accept etc

reporting of decision rule used

Other Changes

Emphasis on Impartiality (measures) vs Independence (inate)

“Scoping” of Laboratory activities to be included in lab

system to describe boundaries of covered activity

2nd person for complaint handling (small labs)

Traceability possible from conformity certificates

Foreword

Introduction

1 Scope

2 Normative references

3 Terms and definitions

4 General requirements

5 Structural requirements

6 Resource requirements

7 Process requirements

8 Management requirements (with options)

Annex A (traceability)

Annex B (MS Options)

Bibliography

A look at the Standard

A first pass through the

new Standard

Remember, there are very few technical changes, these are

mainly more philosophical to modernise and introduce Risk

and Opportunity.

The structure is similar to 17020 and 17065.

You will see many of the same clauses as in 2005, but could

you suggest if they are Structural, Resource or Process?

A Revised Definition

Definition of Laboratory:

3.6

“Laboratory:

A body that performs one or more of the

following activities:

Calibration

Testing

Sampling, associated with subsequent

calibration and testing”

Another Definition

Definition of Decision Rule:

3.7

“rule that describes how measurement

uncertainty is accounted for when stating

conformity with a specified requirement”

4. General Requirements

4.1 Impartiality

There are no references to independence.

Impartiality considerations shall be ongoing.

4.1.4

“the laboratory shall identify risks to its

impartiality on an on-going basis……..

5. Structural Requirements

Scoping

“5.3 The laboratory shall define and document

the range of laboratory activities for which it

conforms with this document. The laboratory

shall only claim conformity with this document

for this range of laboratory activities, which

excludes externally provided laboratory

activities on an ongoing basis

6. Resource Requirements

6.2 Personnel

No Job Descriptions specified

“6.2.4 The management of the laboratory shall

communicate to personnel their duties,

responsibilities and authorities.

but some procedures and records are mandatory

6. Resource Requirements

“6.2.5 The laboratory shall have procedure(s) and

retain records for:

a) determining the competence requirements;

b) selection of personnel;

c) training of personnel;

d) supervision of personnel;

e) authorization of personnel;

f) monitoring competence of personnel.”

and some explicit authorisations are mandatory

6. Resource Requirements

“6.2.6 The laboratory shall authorize personnel to

perform specific laboratory activities, including

but not limited to, the following:

a) development, modification, verification and

validation of methods;

b) analysis of results, including statements of

conformity or opinions and interpretations;

c) report, review and authorization of results.”

6. Resource Requirements

Traceability 6.5 has unchanged intention, but is

clearer. See also Annexe A.

Effectively allows “the three ways” but presumes

competence for those sources complying with

17025 Calibration and 17034 CRM

Acceptable evidence would be accreditation under

the ILAC Arrangement or the CIPM MRA

6. Resource Requirements

There are no significant changes about

subcontractors and external supplies, but the

wording is quite different

“6.6 Externally provided products and services”

A requirement to inform and agree with the

client is when laboratory activity is conducted

by an external body is elsewhere, in 7.1.1 c)

7. Process Requirements

Review of Requests (Contract Review) largely

unchanged. The lab may have to divulge the

identity of an external supplier

“7.1.1c) c) where external providers are used,

the requirements of 6.6 are applied and the

laboratory advises the customer of the specific

laboratory activities to be performed by the

external provider and gains the customer's

approval

7. Process Requirements

The clause on Decision Rules (Pass/Fail

Criteria) is much clearer now and obviates the

need for ILAC to specify a method as in ILAC

G8.

There are clearly choices to make and agree

with clients, so suggestions and examples will

be useful in new guidance documents

7. Process Requirements

7.1.3 When the customer requests a statement

of conformity to a specification or standard for

the test or calibration (e.g. pass/fail, in-

tolerance/out-of-tolerance), the specification or

standard and the decision rule shall be clearly

defined. Unless inherent in the requested

specification or standard, the decision rule

selected shall be communicated to, and

agreed with, the customer.

7. Process Requirements

7.1.4 Any differences between the request or

tender and the contract shall be resolved

before laboratory activities commence. Each

contract shall be acceptable both to the

laboratory and the customer. Deviations

requested by the customer shall not impact the

integrity of the laboratory or the validity of the

results.

7. Process Requirements

7.7.2 The laboratory shall monitor its

performance by comparison with results of

other laboratories, where available and

appropriate. This monitoring shall be planned

and reviewed and shall include, but not be

limited to, either or both of the following:

a) participation in proficiency testing;

b) participation in interlaboratory comparisons

other than proficiency testing.

7. Process Requirements

Three pages of reporting requirements in the

new Standard, split into Common, Testing,

Calibration and Sampling, but….

7.8.1.3 When agreed with the customer, the

results may be reported in a simplified way.

Any information listed in 7.8.2 to 7.8.7 that is

not reported to the customer shall be readily

available.

7. Process Requirements

and when sampling is involved….

7.8.3.2 Where the laboratory is responsible for

the sampling activity, test reports shall meet

the requirements listed in 7.8.5

with a similar clause for calibration

7. Process Requirements

On Sampling (Only?) Reports

7.8.5 f) information required to evaluate

measurement uncertainty for subsequent

testing or calibration.

7. Process Requirements

Complaints

Note that there is a detailed section on complaint

handling and a complaint is defined as

3.2 Complaint

expression of dissatisfaction by any person or

organization to a laboratory (3.6), relating to the

activities or results of that laboratory, where a

response is expected

7. Process Requirements

Complaints

Now we need a 2nd person to handle a complaint

7.9.6 The outcomes to be communicated to the

complainant shall be made by, or reviewed and

approved by, individual(s) not involved in the

original laboratory activities in question.

NOTE This can be performed by external

personnel.

8. Management System

Requirements

8.1 Options All labs:

8.1.1 General

The laboratory shall establish, document,

implement and maintain a management system

that is capable of supporting and demonstrating

the consistent achievement of the requirements of

this document and assuring the quality of the

laboratory results.

8. Management System

Requirements

8.1 Options

8.1.1 General

“In addition to meeting the requirements of

Clauses 4 to 7, the laboratory shall implement a

management system in accordance with Option A

or Option B”

Option A Using Section 8 in the Standard

Option B Using ISO 9001

From Annexe B

“Conformity of the management system

within which the laboratory operates to

the requirements of ISO 9001 does not of

itself demonstrate the competence of the

laboratory to produce technically valid

data and results. This is accomplished

through compliance with clauses 4 to 7 of

ISO/IEC 17025.”

A raison d'être for 17025 vs 9001

Or why bother having 17025?

8. Management System

Requirements

8.1.2 Option A

Section 8 in the Standard

A list of minimum features, mainly as before, with

useful detail. Note that it now includes....

— actions to address risks and opportunities

8. Management System

Requirements

Option B using ISO 9001

“8.1.3 Option B

A laboratory that has established and maintains a

management system, in accordance with the

requirements of ISO 9001, and that is capable of

supporting and demonstrating the consistent

fulfilment of the requirements of Clauses 4 to 7,

also fulfils at least the intent of the management

system requirements specified in 8.2 to 8.9.”

SHORT BREAK 10 minutes

Now we have a short break to have a cup of tea

and mull over the main message so far…..

No significant technical changes but a new

philosophy.

Previously 17025 requirements managed the

risks, now the lab manages the risks.

Back in Ten Minutes

for Part Two

Major Re-structure from 2005 version; clauses and order changed

Very few changes in requirements

Allows use of ISO9001 as basis for management system

Confirmed that ISO/ILAC/IAF tripartite agreement is renewed

Clarification for inclusion of “Stand-alone” Sampling

New term “Decision Rule” for deciding pass/fail decisions

Consideration of “Risk and Opportunity” throughout

1999/2005

Standard Managed Risk2017

Risk and Opportunity Managed

Part Two

The main changes

1. Risk and OpportunityTrevor Thompson

January 2018

A look at Risk and Opportunity

From the Foreword:

— the risk-based thinking applied in this edition has

enabled some reduction in prescriptive requirements

and their replacement by performance-based

requirements;

— there is greater flexibility than in the previous

edition in the requirements for processes,

procedures, documented information and

organizational responsibilities;

Risk and Opportunity

From the Introduction:

This document requires the laboratory to plan and

implement actions to address risks and

opportunities. Addressing both risks and

opportunities establishes a basis for increasing the

effectiveness of the management system, achieving

improved results and preventing negative effects.

The laboratory is responsible for deciding which

risks and opportunities need to be addressed

Risk and Opportunity

There is mention of risk throughout the Standard

and I take the section on Impartiality as an example:

4.1.4 The laboratory shall identify risks to its

impartiality on an on-going basis. This shall include

those risks that arise from its activities, or from its

relationships, or from the relationships of its

personnel…..

Risk and Opportunity

and

4.1.5 If a risk to impartiality is identified, the

laboratory shall be able to demonstrate how it

eliminates or minimizes such risk

This type of consideration applies to most lab

features and to everything it does.

Risk based approach

The General Case

A risk based approach to management

system implementation is one in

which the breadth and depth of the

implementation of particular clauses

is varied to best suit the perceived risk

involved for the particular laboratory

Less Prescriptive

More Consideration

ISO 17025:2005

• Lab shall have policies

and procedures to ensure

protection of confidential

information… including

electronic storage and

transmission of results

FDIS 17025:2017

• The lab shall ensure the

protection of confidential

information…. including

electronic storage and

transmission of results

The relaxation of prescription makes it essential for each lab to consider

the risk for each clause

To discuss and agree what measures are required

To implement that in a known and controlled way for consistency

To keep under review

Risk for a given clause

• How likely that a given area of compliance might lead to

problems, ie non-compliance with the Standard

Taking into account, the circumstances of the body, like

• Technical nature of the work

• Cultural setting

• Ownership

• Customer base

• Geographics and Environment

• Employees

Impartiality and Risk

The requirement for impartiality is a good example of where the risk and

measures necessary do vary greatly between laboratories.

– A privately owned independent lab, in the UK, with many customers,

where the owner has no other activities or ownerships is unlikely to

need extensive measures to protect impartiality.

– Consider alternatively:

• A lab with only one customer

• A lab where the owner owns some customers

• A lab of a manufacturer also taking on third party work

• A lab with minimum wage-staff in a culture known for corruption

• A lab where its ownership is complex and keeps changing as does

that of related bodies

A technical Example

• 6.4.10 When intermediate checks are necessary to maintain confidence

in the performance of the equipment, these checks shall be carried out

according to a procedure.

• The complexity of this varies according to risk. A gauge block

used as a reference may need little by way of intermediate checks

but a sensitive electronic item exhibiting drift may need frequent

checks, plotting and calculation from comparisons resulting in a

drifting reference value being derived.

• All according to risk; similarly with calibration intervals

This philosophy is not new!

• It has always been a requirement to take appropriate steps but a

tendency to compare activities in dissimilar risk laboratories lead

to some difficulties. Accreditation Bodies were criticised for

“requiring” activities in some labs but not in others.

• Now it is quite clear that the extent of activity to comply with a

particular clause will vary and it is the responsibility of the lab to

achieve this appropriately.

• Clause 8.5 of the new 17025 describes the purpose……..

The purpose

• 8.5.1 The laboratory shall consider the risks and

opportunities associated with the laboratory

activities in order to:

• a) give assurance that the management system

can achieve its intended results;

• b) enhance opportunities to achieve the purpose

and objectives of the laboratory;

• c) prevent, or reduce, undesired impacts and

potential failures in the laboratory activities; and

• d) achieve improvement.

The laboratory shall….

• 8.5.2 The laboratory shall plan:

• a) actions to address these risks and opportunities;

• b) how to:

• integrate and implement the actions into its

management system;

• evaluate the effectiveness of these actions.

• 8.5.3 Actions taken to address risks and

opportunities shall be proportionate to the potential

impact on the validity of laboratory results.

Making risk and opportunity

consideration happen

• Ensure a culture in which risk and opportunity

can be safely considered openly and honestly

• Provide a mechanism for all staff (whose

activities can affect the output of the lab) to

consider this, discuss and bring forward any

ideas

• Agenda item on departmental meetings and

reviews.

• Major item on MS Review agenda

• Expected of all staff by their managers

Why is this a good thing?

• Gives opportunity to be a better lab!

• Can reduce risk (or share it)

• Can provide opportunity to save effort or money

• Can encourage development, new techniques,

quicker or easier calibrations, lower prices,

higher profit, happier customers, better

reputation

• Not all labs are the same so they should not all

have the same features in their management

systems

What is not required

• There is no expectation of adherence to Risk

Management formal standards like ISO 31000

although these may make useful reading in

setting up enhancements in a 17025 laboratory

environment

• It is more expected that the features will be

inherent in the normal operation of the laboratory

using 17025 with the enhancements appearing in

several places in the management system

Part Two

The main changes

2. Management System OptionsTrevor Thompson

January 2018

Annex B.2

“Option A (see 8.1.2) lists the minimum requirements

for implementation of a management system in a

laboratory. Care has been taken to incorporate all

those requirements of ISO 9001 that are relevant to

the scope of laboratory activities that are covered by

the management system. Laboratories that comply

with Clauses 4 to 7 and implement Option A of

Clause 8 will therefore also operate generally in

accordance with the principles of ISO 9001.”

Management System Option A

Annex B.3

“Option B (see 8.1.3) allows laboratories to

establish and maintain a management system

in accordance with the requirements of ISO

9001, in a manner that supports and

demonstrates the consistent fulfilment of

Clauses 4 to 7. Laboratories that implement

Option B of Clause 8 will therefore also

operate in accordance with ISO 9001. “

Management System Option B

4 General requirements

4.1 Impartiality

4.2 Confidentiality

5 Structural requirements

6 Resource requirements

6.1 General

6.2 Personnel

6.3 Laboratory facilities and environmental conditions

6.4 Equipment

6.5 Metrological traceability

6.6 Externally provided products and services

The important clauses

Clauses 4 to 6

7 Process requirements

7.1 Review of requests, tenders and contracts

7.2 Selection, verification and validation of methods

7.3 Sampling

7.4 Handling of test or calibration items

7.5 Technical records

7.6 Evaluation of measurement uncertainty

7.7 Assuring the quality of results

7.8 Reporting of results

7.9 Complaints

7.10 Management of nonconforming work

7.11 Control of data – Information management

The Important Clauses

Clause 7

This contains the management system requirements to be met

by laboratories:

Using 17025 directly – Option A

Using 9001 – Option B

On visits this might often appear as:

LA for Cl 8

TA for Cl 6-7

but it is not quite as simple as that, with Cl 4-5 covered by either

or both. It may be that the visit split is not by clause.

Clause 8 offers the choice

Part Two

The main changes

3. Decision RulesTrevor Thompson

January 2018

This is not new. Previously, in Reporting:

Decision Rules

5.10.3.1 b) where relevant, a statement of compliance/non-

compliance with requirements and/or specifications;

5.10.4.2 When statements of compliance are made, the

uncertainty of measurement shall be taken into account.

There are many ways of doing this and potential for lack of

comparability between labs. ILAC developed guidance…..

But….

Previously, 17025 simply stated that a statement of compliance

(pass/fail) takes uncertainties into account. This was

augmented by ILAC G8 suggesting that the so called ILAC

model was used

Decision Rules (Pass/Fail Criteria)

ResultUncertainty – Limits of possible results

PASS Mark

Clear Pass Pass Likely Fail Likely Clear Fail

Now we have a need to agree and specify the “decision rule”

used

Decision Rules

7.8.6.1 When a statement of conformity to a specification or

standard is provided, the laboratory shall document the decision

rule employed, taking into account the level of risk (such as false

accept and false reject and statistical assumptions) associated

with the decision rule employed and apply the decision rule.

NOTE Where the decision rule is prescribed by the

customer, regulations or normative documents, a further

consideration of the level of risk is not necessary.

To be agreed with client, taking risk level into account:

Decision Rule Choices

• ILAC model (default ?)

• Simple pass/fail ?

• In specification

• In legislation

• Industry expectation

• Client required

• Others, inc specified risk ie % PFA

Customer makes widgets and wants an average of 95% of his

widgets to meet the specification of ≥100 mm height.

The laboratory can measure to an uncertainty of +/- 5 mm at

95% confidence. For this “single tailed” at 95% confidence the

coverage factor is 1.64. The acceptance tghreshold for 100 mm

is therefore 104.1 mm (at u = 2.5 mm)

He tells the laboratory to pass all samples that appear to be at

least 104.1 mm height. They have agreed a decision rule.

If he wanted less wastage he could have the measurement

made more accurately and reduce his PFR.

Example Decision Rule

Decision Rule 2.5% PFA

100 105 mm

BigSmall

Limit

For single tailed test at 95% confidence level the coverage factor is

k = 2 Accept threshold for 100 mm limit is therefore 104.1 mm (for

u = 2.5 mm).

Observed Size

A Police Force considers prosecuting a driver who was

measured to have driven at 35 miles per hour in a 30 mph limit

The uncertainty of the measurement is +/- 3 mph at 95% (ie 2σ)

confidence. They could confidently suggest that 99.96 out of

every 100 drivers caught like this were guilty.

They must never loose a case on technical grounds or else the

whole system will be discredited so they agree a decision rule to

deduct 6 mph (i.e. 4σ) before deciding if a prosecution is made.

This gives a confidence of at least 99.997 %

Example Decision Rule

Decision Rule 0.01% PFR

25 30 35 40 Miles per Hour

FailPass

Limit

For single tailed test at 99.99% confidence level the coverage

factor is k = 3.719 Prosecution threshold for 30 mph limit is

therefore 35.58 mph (for u = 1.5 mph).

Observed Speed

The UKAS Transition Plan

(More details later for Ops Staff affected)

Trevor Thompson

United Kingdom Accreditation Service

UKAS Transition Arrangements

This is our largest ever transition

Around 1500 extra Assessment Days expected.

About £1.5M extra income over three years

Several extra new AMs to be recruited

Special temp LO resource to be provided

UKAS Transition Arrangements

Each lab to have a transition WRAP made by

support staff after new Darwin in June. Earlier

ones to be made by relevant AM

Most labs will have several chances to

transition at routine visits

First, all labs will complete a readiness paper

assessment; a sort of gap analysis.

UKAS Transition Plan Summary

Sep 2017 Tasters by webinar for staff and labs

Oct 2017 Development of Gap Analysis methods

Jan 2018 Published Standard

Jan 2018 Training of Staff and TAs

Mar 2018 New Standard applications accepted

Jan 2019 Until then both or either assessment

Jan 2019 From then new standard only assessed

Jun 2020 Transition completed

Dec 2020 Old standard no longer valid

Key points for Transition

• All labs will be transitioned, they need not apply

• Normally no extra site time by LA or TAs

• Labs will complete readiness gap analysis doc

• Extra office time needed for LA and AM/CM

• Small charge for this to labs (most ½ or 1 day equiv)

• Large labs pay more (especially Wendy’s ones)

• All labs to be transitioned by June 2020.

• 17025:2005 accreditations invalid from Dec 2020

Questions?

• Now, live, click on “question” in Shoretel Control Box

• by email to 17025questions@ukas.com

• On Staff Room via forum